On 3/19/21 3:11 AM, Piotr Krysiuk wrote:
Hi Daniel, On Fri, Mar 19, 2021 at 12:16 AM Stephen Rothwell <sfr@xxxxxxxxxxxxxxxx> wrote:diff --cc kernel/bpf/verifier.c index 44e4ec1640f1,f9096b049cd6..000000000000 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@@ -5876,10 -6056,22 +6060,23 @@@ static int retrieve_ptr_limit(const str if (mask_to_left) *ptr_limit = MAX_BPF_STACK + off; else - *ptr_limit = -off; - return 0; + *ptr_limit = -off - 1; + return *ptr_limit >= max ? -ERANGE : 0; + case PTR_TO_MAP_KEY: + /* Currently, this code is not exercised as the only use + * is bpf_for_each_map_elem() helper which requires + * bpf_capble. The code has been tested manually for + * future use. + */ + if (mask_to_left) { + *ptr_limit = ptr_reg->umax_value + ptr_reg->off; + } else { + off = ptr_reg->smin_value + ptr_reg->off; + *ptr_limit = ptr_reg->map_ptr->key_size - off; + } + return 0;PTR_TO_MAP_VALUE logic above looks like copy-paste of old PTR_TO_MAP_VALUE code from before "bpf: Fix off-by-one for area size in creating mask to left" and is apparently affected by the same off-by-one, except this time on "key_size" area and not "value_size". This needs to be fixed in the same way as we did with PTR_TO_MAP_VALUE. What is the best way to proceed?
Hm, not sure why PTR_TO_MAP_KEY was added by 69c087ba6225 in the first place, I presume noone expects this to be used from unprivileged as the comment says. Resolution should be to remove the PTR_TO_MAP_KEY case entirely from that switch until we have an actual user. Thanks, Daniel
